Yes

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab
+
+[*.{rs,toml}]
+indent_size = 4

.env.example

@@ -0,0 +1,188 @@
+# =============================================================================
+# StreamPay Frontend Environment Configuration
+# =============================================================================
+# 
+# SECURITY NOTES:
+# - Never commit real credentials to version control
+# - Use different secrets for testnet and mainnet
+# - CI must use testnet only (enforced by GitHub Actions)
+# - JWT_SECRET must be at least 32 characters in production
+# - STELLAR_NETWORK is required - no silent fallback to mainnet
+#
+# =============================================================================
+# REQUIRED VARIABLES
+# =============================================================================
+
+# Stellar Network Configuration
+# Options: testnet, mainnet
+# Required: Yes
+# Purpose: Selects which Stellar network to use
+# Security: CI will fail if set to 'mainnet'
+STELLAR_NETWORK=testnet
+
+# JWT Secret for Authentication
+# Required: Yes
+# Purpose: Signs and verifies JWT tokens for wallet authentication
+# Security: Must be at least 32 characters. Do not use default in production.
+# Example: Use a secure random string generator
+JWT_SECRET=your-super-secret-jwt-key-min-32-chars-change-this
+
+# Allowed browser origins for public API requests
+# Required: Yes
+# Purpose: Controls CORS access for frontend API calls
+# Example: http://localhost:3000
+ALLOWED_ORIGINS=http://localhost:3000
+
+# Node Environment
+# Required: No (defaults to development)
+# Options: development, production, test
+# Purpose: Controls application behavior and optimizations
+NODE_ENV=development
+
+# =============================================================================
+# OPTIONAL VARIABLES
+# =============================================================================
+
+# Service Name
+# Required: No (defaults to streampay-frontend)
+# Purpose: Identifies service in logs and monitoring
+SERVICE_NAME=streampay-frontend
+
+# Internal Auth Token
+# Required: No
+# Purpose: Token for service-to-service authentication
+# Security: Only set for internal service communication
+INTERNAL_AUTH_TOKEN=
+
+# Anomaly Detection Thresholds
+# Required: No (defaults to 50 and 20)
+# Purpose: Configures fraud detection limits
+ANOMALY_CREATION_THRESHOLD=50
+ANOMALY_SETTLE_THRESHOLD=20
+
+# Request Body Size Cap for /api/v2/streams* (POST, PUT, PATCH)
+# Required: No (defaults to 262144 = 256 KB)
+# Purpose: Middleware rejects requests whose Content-Length exceeds this value
+#          with a 413 status and a machine-readable error envelope.
+#          Only write methods on /api/v2/streams* are subject to this cap;
+#          GET/HEAD/OPTIONS/DELETE and all other paths are unaffected.
+# Example: 131072 for a 128 KB cap, 524288 for a 512 KB cap
+MAX_STREAM_BODY_BYTES=262144
+
+# Request Body Size Cap for /api/webhooks* (POST, PUT, PATCH)
+# Required: No (defaults to 1048576 = 1 MB)
+# Purpose: Middleware rejects webhook requests whose Content-Length exceeds this
+#          value with a 413 status and a machine-readable error envelope.
+#          Only write methods on /api/webhooks and /api/webhooks/* are subject
+#          to this cap; all other paths are unaffected.
+# Example: 2097152 for a 2 MB cap
+MAX_WEBHOOK_BODY_BYTES=1048576
+
+# =============================================================================
+# NETWORK PROFILES
+# =============================================================================
+#
+# TESTNET PROFILE:
+# - Horizon URL: https://horizon-testnet.stellar.org
+# - Passphrase: Test SDF Network ; September 2015
+# - Friendbot: Available for funding
+# - Explorer: https://stellar.expert/testnet
+# - Asset Label: TESTNET (for UI safety)
+#
+# MAINNET PROFILE:
+# - Horizon URL: https://horizon.stellar.org
+# - Passphrase: Public Global Stellar Network ; September 2015
+# - Friendbot: Not available
+# - Explorer: https://stellar.expert
+# - Asset Label: (empty)
+#
+# =============================================================================
+# ENVIRONMENT MATRIX
+# =============================================================================
+#
+# Variable              | Testnet | Mainnet | CI | Required
+# ---------------------|---------|---------|----|----------
+# STELLAR_NETWORK      | testnet | mainnet | testnet only | Yes
+# JWT_SECRET           | dev key | prod key | dev key | Yes
+# SERVICE_NAME         | optional| optional| optional | No
+# INTERNAL_AUTH_TOKEN  | optional| optional| optional | No
+# ANOMALY_*_THRESHOLD  | optional| optional| optional | No
+#
+# =============================================================================
+# SETUP INSTRUCTIONS
+# =============================================================================
+#
+# 1. Copy this file to .env.local:
+#    cp .env.example .env.local
+#
+# 2. For local development (testnet):
+#    - Set STELLAR_NETWORK=testnet
+#    - Set JWT_SECRET to a random string (can be short for dev)
+#    - Start with: npm run dev
+#
+# 3. For production deployment (mainnet):
+#    - Set STELLAR_NETWORK=mainnet
+#    - Set JWT_SECRET to a secure 32+ character random string
+#    - Set NODE_ENV=production
+#    - Deploy via your hosting platform
+#
+# 4. For CI/CD:
+#    - CI automatically enforces testnet-only
+#    - Set secrets in GitHub Actions or your CI platform
+#    - Never use production secrets in CI
+#
+# =============================================================================
+# KMS AND SIGNING STRATEGY
+# =============================================================================
+#
+# StreamPay never holds raw secret keys in process memory at rest. The
+# KMS abstraction lets us swap between a real cloud KMS in production
+# and a deterministic mock in development / CI.
+#
+# Provider options:
+#   - 'aws-kms'    : Production. KMS_KEY_ID and KMS_REGION required.
+#                    Signing latency: ~50-150ms per request.
+#                    Keys never leave AWS; we hold only references.
+#   - 'local-mock' : Development / CI only. Uses STELLAR_MOCK_SECRET.
+#                    Latency: synchronous, in-process. Never set this
+#                    in production — the app will fail-fast at boot.
+KMS_PROVIDER=local-mock
+
+# AWS KMS Configuration (required if provider is 'aws-kms')
+KMS_KEY_ID=
+KMS_REGION=us-east-1
+
+# Local Mock Configuration
+# SECURITY: Never use these in production
+STELLAR_MOCK_SECRET=S_MOCK_SECRET_KEY_56_CHARS_LONG_AAAAAAAAAAAAAAAAAAAAAAA
+
+# =============================================================================
+# SECURITY CHECKLIST
+# =============================================================================
+#
+# Before deploying to production:
+# [ ] STELLAR_NETWORK is set to 'mainnet' (if deploying to mainnet)
+# [ ] JWT_SECRET is at least 32 characters
+# [ ] JWT_SECRET is NOT the default value
+# [ ] NODE_ENV is set to 'production'
+# [ ] No testnet secrets are used with mainnet configuration
+# [ ] Horizon URL matches the selected network
+# [ ] Internal auth tokens are set if using service mesh
+# [ ] Anomaly thresholds are appropriate for your traffic
+#
+# =============================================================================
+# TROUBLESHOOTING
+# =============================================================================
+#
+# Error: "STELLAR_NETWORK environment variable is required"
+# Fix: Set STELLAR_NETWORK=testnet or STELLAR_NETWORK=mainnet in .env.local
+#
+# Error: "JWT_SECRET must be at least 32 characters"
+# Fix: Generate a longer secret using: openssl rand -base64 32
+#
+# Error: "CI environment detected with mainnet network configuration"
+# Fix: CI is restricted to testnet. Use testnet in CI or deploy manually.
+#
+# Error: "Production environment cannot use default JWT_SECRET"
+# Fix: Set a custom JWT_SECRET when NODE_ENV=production
+#

.env.testnet.example

@@ -0,0 +1,42 @@
+# .env.testnet.example
+# Copy this file to .env.testnet and fill in your values.
+# NEVER commit .env.testnet to version control.
+
+# ── Stellar Network ─────────────────────────────────────────────────────────────
+# Network identifier: testnet | futurenet | pubnet (use testnet for development)
+STELLAR_NETWORK=testnet
+
+# Horizon API endpoint (testnet)
+STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
+
+# Friendbot URL for funding testnet accounts
+STELLAR_FRIENDBOT_URL=https://friendbot.stellar.org
+
+# ── Testnet Accounts ────────────────────────────────────────────────────────────
+# Generated by scripts/stellar-dev.sh — DO NOT commit these keys
+# Replace with your own testnet keys after running the script
+STELLAR_SEED_SECRET_KEY=
+STELLAR_SEED_PUBLIC_KEY=
+
+# ── Frontend Config ─────────────────────────────────────────────────────────────
+# Backend API URL (required for frontend to work)
+NEXT_PUBLIC_API_URL=http://localhost:4000
+
+# Comma-separated browser origin allowlist for public API CORS
+ALLOWED_ORIGINS=http://localhost:3000
+
+# Optional: Stellar asset code for streams (default: XLM)
+NEXT_PUBLIC_STELLAR_ASSET_CODE=XLM
+
+# Optional: Stellar asset issuer (leave empty for native XLM)
+NEXT_PUBLIC_STELLAR_ASSET_ISSUER=
+
+# ── Development ─────────────────────────────────────────────────────────────────
+# Node environment (never set to production for testnet)
+NODE_ENV=development
+
+# Number of test accounts to create (default: 2)
+ACCOUNTS_TO_CREATE=2
+
+# Path to seed script (default: scripts/seed-streams.js)
+SEED_SCRIPT=scripts/seed-streams.js

.eslintrc.json

@@ -0,0 +1,10 @@
+{
+  "extends": ["next/core-web-vitals", "next/typescript"],
+  "ignorePatterns": [
+    ".next/",
+    "node_modules/",
+    "eslint.config.mjs",
+    "jest.config.js",
+    "next-env.d.ts"
+  ]
+}

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,102 @@
+## Security Changes
+
+### Type of Security Change
+- [ ] SAST rule update
+- [ ] Dependency vulnerability fix
+- [ ] Exemption addition/renewal
+- [ ] Security workflow modification
+- [ ] Container image update
+- [ ] Other: _______________
+
+### Vulnerability Details (if applicable)
+
+**CVE/Advisory ID:** 
+- CVE-ID: 
+- GHSA-ID: 
+
+**Affected Package:**
+- Name: 
+- Version: 
+- Severity: [ ] Critical [ ] High [ ] Medium [ ] Low
+
+**Fix Applied:**
+- [ ] Package version bump
+- [ ] Code change to mitigate
+- [ ] Configuration update
+- [ ] Exemption granted (see below)
+
+### Exemption Request (if applicable)
+
+**Exemption ID:** EXEMPT-___
+
+**Justification:**
+<!-- Detailed reason why this vulnerability can be temporarily exempted -->
+
+**Mitigation Applied:**
+<!-- What compensating controls or workarounds are in place -->
+
+**Expiry Date:** YYYY-MM-DD (max 90 days from now)
+
+**Review Plan:**
+<!-- How and when this will be re-evaluated -->
+
+### Testing
+
+- [ ] Ran `npm audit` locally - output attached or no new vulnerabilities
+- [ ] Security workflow passes on this branch
+- [ ] Test suite passes: `npm test`
+- [ ] Build succeeds: `npm run build`
+
+### Security Impact Analysis
+
+**Affected Components:**
+- [ ] Authentication/Authorization
+- [ ] Payment processing
+- [ ] Data encryption
+- [ ] API endpoints
+- [ ] Dependencies
+- [ ] Container images
+- [ ] CI/CD pipeline
+- [ ] Other: _______________
+
+**Risk Assessment:**
+<!-- Describe any potential security risks introduced or mitigated by this change -->
+
+### Documentation Updates
+
+- [ ] Updated README.md (if workflow changed)
+- [ ] Updated SECURITY-CI-SETUP.md (if process changed)
+- [ ] Updated security-exemptions.json (if applicable)
+- [ ] Added security notes to code comments
+
+### Checklist
+
+- [ ] No secrets or keys committed
+- [ ] No PII or sensitive data in logs
+- [ ] All security scans pass (or exemptions documented)
+- [ ] Branch protection requirements met
+- [ ] Code review from security team (for critical changes)
+
+### Additional Notes
+
+<!-- Any additional context, links to advisories, or relevant discussions -->
+
+### Test Output
+
+```
+# Paste npm test output here
+npm test
+
+# Paste npm audit output here (if relevant)
+npm audit
+```
+
+### CI Run Link
+
+<!-- Link to passing GitHub Actions run -->
+Workflow Run: 
+
+---
+
+**Security Review Required:** @security-team
+**Compliance Impact:** [Yes/No - explain if yes]